29 ms·

Stop the Earn IT Bill Before It Breaks Encryption

• anonymfus 6y ago
  There is a clear need for an opposite law which will make backdoors illegal. Who could fight for it?
  • abvdasker 6y ago
    Very few elected politicians of either party.
  • t-writescode 6y ago
    It's really easy. You just have to say that the backdoors are a method to stop [very big bad] from happening and that without it, you're supporting [very big bad]. The thing we have to come as a society is willing to accept that sometimes [very big bad] will happen, but a lack of back doors is more important.
    • triceratops 6y ago
      Backdoors are a method to allow predators to spy on children online. If you support backdoors, you're supporting predation on children.
  • mikeyjk 6y ago
    Sadly Australia did the opposite - they can force us to backdoor applications and punish us for refusing. Australia is not the place to look for security applications.
    • raxxorrax 6y ago
      Ah, the old penal colony mindset where the citizens are secretly prisoners.
      • classified 6y ago
        Except it’s not a secret any more.
      • Rebelgecko 6y ago
        When asked about how the law would ban certain mathematical operations, IIRC the Australian PM said something along the lines of "The laws of mathematics should be subservient to the laws of Australia"
        • AnimalMuppet 6y ago
          Yeah, good luck with that. Let us know how it works out for you, Australia.
    • BLKNSLVR 6y ago
      As an Australian, my plan is to route most of my traffic through a self hosted VPN on a server that resides outside the five eyes (and possibly also the extended thirteen eyes). Yes, there are insecurities and holes in the above, pending the methods of implementation, but it's one level of potentially many. And whilst it's good to know that there are technical workarounds such as this, the real work, the real progress for society, is to make these technical workarounds unnecessary by, as the EFF says, contacting your representatives and letting them know what they're constituency thinks. Politics, sickeningly, is the only avenue for worthwhile change.
• sdoering 6y ago
  I strongly believe we have lost the war for privacy and security (against state level actors) already. Once the net adopted the platform model, we were screwed. Platforms are as easy to regulate, as for example the telephone companies were back in the days. They were easily forced to comply with wiretapping demands of the government. The moment a central platform controlled (most of) our communication and was able to provide security to the users by using encryption, legislators realized the danger and also the solution. They would just need to force these central hubs with laws as they did back in the day. Legislation was/is needed to break users' encryption and give government the access to all communication that was lost with modern forms of communication and encryption. So on one hand, it is "just" a return to a previous state of affairs. On the other hand, given for example today's methods of automatically listening in and transcribing voice to text, this would be a way more massive intrusion and control mechanism.
  • Freak_NL 6y ago
    > They were easily forced to comply with wiretapping demands of the government. Of some governments. If you are not one of the five (or whatever) eyes, you probably won't get your hand in WhatsApp's panties; much to the annoyance of those governments (e.g., the Dutch government which in its current incarnation seems to have developed a dislike for end-to-end encryption as well). For American citizens to be spied on by their on government is an affront, but at least it's a government you can vote for. China sidesteps this issue completely by using home-grown platforms like WeChat of course.
    • StavrosK 6y ago
      > China sidesteps this issue completely by using home-grown platforms like WeChat of course. How is that different from what the US does? It seems to me an error to think that US companies are somehow the default, and any other country using its own services is sidestepping the issue.
      • Freak_NL 6y ago
        It's not that different, only that China was acting in response to the status quo of US companies dominating this global market. For most users outside of the US those companies are the default; China excepted. By 'default' I don't mean to imply that this is desirable or healthy though.
• irrational 6y ago
  Would this have any affect on software developed outside of the USA? The USA is becoming increasingly irrelevant on the world stage. Couldn’t a company in some other country create a browser with encryption that any of us could use? Could Apple move iOS development offshore and continue creating a mobile OS with encryption?
  • AmericanChopper 6y ago
    The world is welcome to compete with American tech, and has been trying very hard at it for quite a long time.
    • blackbear_ 6y ago
      And America is welcome to put up a fair fight instead of banning competitors.
      • AmericanChopper 6y ago
        If a fair fight is one where everybody plays by the same rules, then America fights as fair as you can get. The main issue with something like this though isn’t really about the rest of the world catching up to the US technologically. It’s a question of whether service providers would choose not operating in the US over following their rules. But given the size of the US market, you’d find a lot of service providers choosing to follow the rules. Which is incidentally the same way EU nations enforce their laws on companies like Google. And how countries like France, Germany and UK would enforce the anti-encryption laws they’ve been trying for years to get on the books.
    • selfhoster11 6y ago
      America hasn't been trying that hard to make a power grab on shared tech like encryption, so it's possible that the rest of the world will have a fighting chance.
    • colinb 6y ago
      Hmm. I'm not sure the Chinese government would agree with your first statement. They seem to be getting significant US opposition to their technology advancement. Yes, I'm aware of some of the issues surrounding IP copying. I won't call it theft because the word is contentious and there are those in this forum who don't think you can steal ideas. I'm also aware of the US' own history of gathering IP to bootstrap its industrial efforts. I guess that "but you did it first" isn't a good defence in law (not really sure of that, after all IANAL) but it makes the US case weaker in my eyes.
• mytailorisrich 6y ago
  I think that the key point that should be addressed by those against this bill and these laws in general is: How to conduct legitimate law enforcement business and police investigations at a time when most communications have moved online? The reason the Attorney General and the DOJ want some sort of access to communications is not to undermine free speech and to take over the world, it is because they know that without legal provisions technology can make it impossible to access communication during legitimate police investigations. How do we solve this problem?
  • choward 6y ago
    > they know that without legal provisions technology can make it impossible to access communication during legitimate police investigations > How do we solve this problem? It's called a search warrant.
    • mytailorisrich 6y ago
      Well, no. That's the issue! If you only have peer-to-peer encryption with communications still passing through servers unencrypted then, sure, you can get a warrant to force disclosure. With end to end encryption, however you can show up with a warrant all you want it makes no difference because they physically cannot hand you clear-text communications. Same for encryption at rest. The strength of the encryption algorithms we have today makes it near impossible to recover the clear-text data.
      • monocasa 6y ago
        A search warrant for the endpoints.
        • mytailorisrich 6y ago
          And I will refuse to cooperate because I know what my "endpoint" contains, because of course my device is also encrypted and/or will be destroyed if I think I'm about to get caught. Your script kiddie might break at the suggestion that refusing to cooperate means 2 to 5 years in jail but organised crime, or people who are risking a much harsher penalty, won't. These are the real, down to Earth issues, not utopian discussions about individual liberties.
• choppaface 6y ago
  Wrote Feinstein and got a reply (?!) that EARN-IT is “misunderstood” and that she won’t stop supporting it womp womp. Why does this bill have any bi-partisan support?? Would expect there would at least be some large special interests funding an opposition... big companies rely on encryption to keep secrets.
  • toyg 6y ago
    > big companies rely on encryption to keep secrets. A lot of big companies have old and crusty leaders / owners, who do not understand the terms of this problem. I wouldn't be surprised to see this bill pass and then get nerfed in a few years, once big corporations actually experience the operational cost and lobby to have it rolled back / made it optional for them.
  • srtjstjsj 6y ago
    Many people have a delusion that just because they find that one major party is bad then the other one must be good. It's part of a common psychological phenomenon that has us overlook flaws in our allies/friends/family because we need them and can't survive alone.
  • defnotashton2 6y ago
    The distinction between the parties is little more than an illusion.
  • cure 6y ago
    That's not exactly surprising. Feinstein is always on the wrong side of copyright/patent/encryption bills. Just look up her voting record. She co-sponsored PIPA. See also https://www.wired.com/2016/04/senates-draft-encryption-bill-privacy-nightmare/ https://www.wired.com/2016/04/senates-draft-encryption-bill-.... She co-sponsored the Sonny Bono Copyright Term Extension Act, too. She's hopeless on this.
• nix23 6y ago
  What i don't get, yes you can force Facebook to implement Backdoors, but how would you do that with a opensource project like Matrix or even the full opensource Android?
  • giantDinosaur 6y ago
    Many options: - block access ala GFW, ensuring that most people will have difficulty accessing it or using it - block access to any data you cannot decrypt or from an endpoint you cannot backdoor - go after creators and ensure some kind of backdoor is inherent to the project - shut down projects by exerting pressure on developers - run some kind of propaganda campaign on the evils of using unsanctioned software (supporting terrorism etc.) - do nothing, knowing that most users will avoid using anything that isn't one of the major web platforms
    • nix23 6y ago
      >go after creators and ensure some kind of backdoor is inherent to the project >shut down projects by exerting pressure on developers The developer probably just going to the press with that, no need to damage your own private centric project, sure the NSA can say they never did that so the developers can ignore it OR they openly say it was them, then the project just can change the country. >run some kind of propaganda campaign on the evils of using unsanctioned software (supporting terrorism etc.) >do nothing, knowing that most users will avoid using anything that isn't one of the major web platforms Those are probably the only viable solutions, but on the other hand it's pure marketing for the product, like banning telegram in Russia.
      • zepto 6y ago
        What is the developer going to the press with?
        • nix23 6y ago
          Publication
• ghastmaster 6y ago
  > The EARN IT Act cynically uses crimes against children as an excuse to hand control of online privacy and speech over to state legislatures I like the idea of federal legislature ceding power to state legislatures. Additionally, it looks like encryption is offered more protections in this bill, Considering federal laws preempt state, especially with regard to telecommunications, I do not see what the risks are with passing this(regarding encryption). The bill ammends Section 230(e) of the Communications Act of 1934. > CYBERSECURITY PROTECTIONS DO NOT GIVE RISE TO LIABILITY.—Notwithstanding paragraph (6), a provider of an interactive computer service shall not be deemed to be in violation of section 2252 or 2252A of title 18, United States Code, for the purposes of subparagraph (A) of such paragraph (6), and shall not otherwise be subject to any charge in a criminal prosecution under State law under subparagraph (B) of such paragraph (6), or any claim in a civil action under State law under subparagraph (C) of such paragraph (6), because the provider— “(A) utilizes full end-to-end encrypted messaging services, device encryption, or other encryption services; “(B) does not possess the information necessary to decrypt a communication; or “(C) fails to take an action that would otherwise undermine the ability of the provider to offer full end-to-end encrypted messaging services, device encryption, or other encryption services.”. https://www.congress.gov/bill/116th-congress/senate-bill/3398/text https://www.congress.gov/bill/116th-congress/senate-bill/339...
  • deleted 6y ago
    [deleted]
  • dmos62 6y ago
    I won't challenge the bill directly, but I'll point out that putting "crimes against children" front and center smells of misdirection, so it begs the question of what's really the bill's goal (though that could be just bad campaigning). Also, Edward Snowden spoke out against this bill. That's hearsay, but personally I've a fair amount of trust in his assessments.
    • ghastmaster 6y ago
      The meat of the bill is that it establishes a commission (yes yet another, unpaid though!) that will establish and forward best practices to AG Barr concerning child sexual exploitation online. It is possible that one of the recommendations might be establishing a backdoor. In the future that recommendation would then be used to argue for legislation. Snowden is great, but do your own research. Edit: I usually trust Snowden as well. I could be missing something in this bill. EFF did not provide specifics. Hopefully someone here can.
• ry454 6y ago
  Politics can be Luddites too? They see the world is moving forward, and as it's escaping the reach of their small grabby hands, they enact the "Earn IT" act as an attempt to return the times where their little grabby minds were able to watch and control others.
• metadatabad 6y ago
  I remember someone from here posting about how the user contacted Feinstein and got the most boilerplate response possible. They honestly do not care about the citizens at this point.
  • CryptoPunk 6y ago
    Perusing /r/politics, all I see is astroturfing, and it garners tens of thousands of upvotes. The age of true democratic participation is over. Politicians have no need to care about the ordinary constituent to win elections. They just need to win over the elite, and know how to deliver their scripts.
    • indymike 6y ago
      Actually, reality is counterintuitive. Being in congress is a terrible job where you do not even have time to read 1/2 of the bills you are going to vote on this week. So you count on others to help you. Mostly this is staffers, interns and lobbyists because those are the people who show up and help. If you as a citizen want to make change, then all you have to do is show up, in person and have a friendly conversation with the rep or even just with their staffers. Come with easy to understand stories, and be able to rationally talk about the other side. E.g. I realize that law enforcement has a strong story about encryption, but there is a reason we don't require home, car and safe buyers to give law enforcement a master key. Yes, some bad cops might steal, but what is worrisome is that the bad guys might get the the kes. That's exactly what they are asking for here: a master key.
      • nobody9999 6y ago
        For more information about how to interact and influence your government (it is, after all, made up of us, at least in the US -- and in other places too, but I'm American so I focus on that), check out Take Back Your Government[0] by Robert Heinlein. [0] https://en.wikipedia.org/wiki/Take_Back_Your_Government https://en.wikipedia.org/wiki/Take_Back_Your_Government
  • indymike 6y ago
• TapaJob 6y ago
  The question is what is really secure? Running Telegram, over multiple VPN's? Accessing Gmail over multiple VPN's so Google doesnt get to know where you are 'really' logging on from? Making your own VPN network over a combination of AWS, G-Cloud, Azure, DO and Aliyun to 'hide' your actual location? Peoples thoughts?
  • BLKNSLVR 6y ago
    Rotate through various VPNs as your initial portal, and throw tor in there as well. Share your VPN with friends and family to provide some 'noise' (although that may be worth little overall - maybe VPN through friends and family home connections as well).
  • fsflover 6y ago
    I2P: https://geti2p.net https://geti2p.net.
  • ta76893547 6y ago
    It really depends on what you want or what your personal situation is. I'll give my thoughts on a few possible adversaries. - 1. An individual attempting to perform an MITM attack on you. The classic free wifi adversary you've probably heard about. There's little risk of this individual using the sites you visit against you so you only care that they can't manipulate your usage of said sites: Use HTTPS and you'll be fine. - 2. Your ISP. You don't want them to see where any of your traffic is going because you don't trust them: Use a VPN. Shift the trust to either a VPN provider or a cloud-hosting provider by running your own VPN. - 3. Your Government. Let's assume they can see all of the traffic within the country and you don't want them to associate your traffic with you: This is the step where it becomes challenging, you want to blend in, not just add more security steps. Ideally you want your traffic to leave the governments jurisdiction and if needed reenter looking like normal traffic from other countries. Tor is a good option here, there's a reasonable amount of traffic on the Tor network to hide in and your traffic is almost guaranteed to leave your country at some point. Alternatively choose a VPN provider that resides legally outside of your country and choose a server that resides physically outside of your country. Both options will move your traffic outside of the jurisdiction of your government, so this should be sufficient within the confines of the current example. - - What about a self-hosted vpn in a region outside my country? If you ever connect to a server inside your country the full path of your traffic will be able to be seen by your government. - - What about multiple self-hosted VPNs outside my country? This is an improvement on the previous issue, but it's unlikely to prevent your traffic from being correlated to you on timing alone. - 4. God's Eye. Your adversary can see all internet traffic everywhere on Earth: Good luck. Maybe use Tor over a popular VPN service to increase the difficulty of correlating your traffic to you? Hope the Nym mixnet becomes popular? Some additional considerations: - What if I don't trust a VPN provider? You probably want to hide your traffic in their traffic so pick a VPN provider that requires no user info to sign up and let's you pay with a cryptocurrency or cash. I know of Mullvad that fits this requirement, there are probably others as well. Self host a VPN and to the VPN service through your VPN, now neither the VPN service or the cloud provider has a full view of your traffic (wireguard makes multihop VPNs easy). You could do the same by use 2 vpn providers.
• izzytcp 6y ago
  All of you smart arses out here and there, we know it, we know. We know, VPNs and other stuff in between are not so secure and not private. Stop saying it, don't you have some other piece of knowledge to be proud of? for god's sake. Tor and Signal are better than Public Cloud, Chrome & SMS if you're looking for privacy. Don't you have common sense? - HTTPS is more secure and private than HTTP - Signal is more secure and private than SMS/Skype/Messenger - Tor/Browser is more secure and private than Cloud/Chrome - FileVault, BitLocker and LUKS are more secure and private than RAW unencrypted disk data - 2FA and Hashing is better than raw Passwords - List goes on and on. All you have to do is: get out of your desperate situation where "everything's controlled", because it's not true, at least not everything. We don't have the best security and privacy but we have some of it AND we need to fight to keep and expand it. Now go on and tell me how smart you are and how you see things different and generalize stuff again in replies. Or you can just shut up and stand up to contribute and improve it.
  • nojvek 6y ago
    There are two parts. 1) Yes, you can build better encryption and privacy preserving technology. That is a technology and adoption problem. 2) There is so much you can do once the law says you can’t encrypt certain kinds of things and if you do, the state will be after you. That is a social problem. Our elected leaders aren’t serving us. Not mutually exclusive. We have to do both. Build better tech, educate others and esp our politicians who can change the fabric of society.
    • SkyBelow 6y ago
      3) People are willing to sacrifice freedoms to protect kids, likely a result of not understanding the complexities of such a nightmarish problem and how much freedom will have to be sacrificed and how little protection will be gained at great cost. Why? Because our society does not allow us to perform cost benefit analysis on a child's well being despite reality giving us no such relief as removing the need for such.
      • andrei_says_ 6y ago
• upofadown 6y ago
  PGP was specifically created to combat this sort of legal threat. It is proof that encryption is ultimately controlled by individuals. The identity management is completely decentralization and it works over pretty much any medium. It seems that the world has somehow forgotten the lesson. People can only see the centralized systems and don't realize that the problem they are trying to solve is not solvable in general. Encryption is unstoppable. * https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip
  • geranim0 6y ago
    You don't seem to understand that this is not about us, but about the average joe who will never learn about PGP.
    • upofadown 6y ago
      Average Joes routinely use PGP on the darknets. So we even have a good current example of how encryption used in crime can come in a form that this legislation is powerless against.
      • glasss 6y ago
        I think if average joe/jane had a definition, it would exclude people that use tor.
  • knobcore 6y ago
    Encryption might be unstoppable but they can always just assign you an IPV6 address and encryption fingerprint that becomes your new online social security number that is required from the compiler on up. Notarize your apps buddy and sign into your app account... ;)
    • upofadown 6y ago
      The threat here is not against anonymity, it is against encryption. You can make as many PGP identities as you want and associate them with any sort of identity you desire, so there might be a political point available with respect to anonymity as well in some situations.
• angel_j 6y ago
  EFF is being disingenuous here, probably at the behest of so many internet service companies, who need your data, and technically own your passwords. They never have, and don't care about your privacy. Don't shill for these companies, not even the ones with good intentions. Your passwords are still protected by your right to privacy, and the 5th amendment. This bill won't change that. It only forced (at your state's discretion) that internet services give records to law enforcement. This could weaken internet services, which only pretend to protect your privacy, and then sell it everything else about your "private bits". It could strengthen privacy by forcing people to get real about their security and take encryption into their own, private hands. Run your own servers, and end-to-end all the things. But the electric sheep can't see this, and trust too blindly EFF and the same internet companies that they otherwise despise for their use of your data. The time to choose in nigh. Either you let MSFAANG keep the lock and key to your data, full wise that they will give it up for ads and authority, or your realize that the only way to change the web is to adapt and use it differently. These companies never cared about your privacy. We know this because of their willingness to comply to, for instance, Chinese authority. Ya'll have been red-scared all over again, decrying China as a threat to the world, while your own Government eats away at your own liberties in the name of protecting you.
• danielvf 6y ago
  I was going to call my Representative, and express my disapproval to my Senators for being on the sponsors list, when I actually read the act. I really don't see what the EFF is talking about. It seems like a very straightforward bill that makes things much better by explicitly removing any liability from companies for either having end to end encryption or for not creating backdoors. Here's my breakdown of the text of the bill: --- Create a commission of 16 people, half appointed by each party. Can only make recommendations that 14 of the 16 approve of. 4 shall have current experience in investigating online child sexual exploitation crimes, of whom, 2 shall have such experience in a law enforcement capacity; and 2 shall have such experience in a prosecutorial capacity; 4 shall be survivors of online child sexual exploitation, or have current experience in providing services for victims of online child sexual exploitation in a non-governmental capacity; 2 shall have current experience in matters related to consumer protection, civil liberties, civil rights, or privacy; and 2 shall have current experience in computer science or software engineering related to matters of cryptography, data security, or artificial intelligence in a non-governmental capacity; and 4 shall be individuals who each currently work for an interactive computer service that is unrelated to each other interactive computer service represented under this subparagraph, representing diverse types of businesses and areas of professional expertise, of whom 2 shall have current experience in addressing online child sexual exploitation and promoting child safety at an interactive computer service with not less than 30,000,000 monthly users in the United States; and 2 shall have current experience in addressing online child sexual exploitation and promoting child safety at an interactive computer service with less than 10,000,000 monthly users in the United States. --- the Commission shall develop and submit to the Attorney General recommended best practices that providers of interactive computer services may choose to engage in to prevent, reduce, and respond to the online sexual exploitation of children, including the enticement, grooming, sex trafficking, and sexual abuse of children and the proliferation of online child sexual abuse material. (A) preventing, identifying, disrupting, and reporting online child sexual exploitation; (B) coordinating with non-profit organizations and other providers of interactive computer services to preserve, remove from view, and report online child sexual exploitation; (C) retaining child sexual exploitation content and related user identification and location data; (D) receiving and triaging reports of online child sexual exploitation by users of interactive computer services, including self-reporting; (E) implementing a standard rating and categorization system to identify the type and severity of child sexual abuse material; (F) training and supporting content moderators who review child sexual exploitation content for the purposes of preventing and disrupting online child sexual exploitation; (G) preparing and issuing transparency reports, including disclosures in terms of service, relating to identifying, categorizing, and reporting online child sexual exploitation and efforts to prevent and disrupt online child sexual exploitation; (H) coordinating with voluntary initiatives offered among and to providers of interactive computer services relating to identifying, categorizing, and reporting online child sexual exploitation; (I) employing age rating and age gating systems to reduce online child sexual exploitation; (J) offering parental control products that enable customers to limit the types of websites, social media platforms, and internet content that are accessible to children; and (K) contractual and operational practices to ensure third parties, contractors, and affiliates comply with the best practices. ---- Amends Sec 230e so that child sexual exploitation law gets its own section, on the list of things that section 230 does not apply to, joining, among other things, all federal criminal law, all IP law, sex trafficking, and privacy laws. The text to be inserted looks similar to the current sex trafficking text? Explicitly say that the entire list of exceptions to 230 does not create liability, either federal or state IF you are end to end encrypting and cannot decrypt. Not creating backdoors does not create liability. ---- Go through all federal laws and change "Child Pornography" to "Child Sexual Abuse Material". --- So overall I don't see the issue. Seems like a good law.
• propogandist 6y ago
  Easiest way to build traction around this effort is to write some stories suggesting Trump is trying to take away encryption (even thought spying has bi-partisan support). The Trump angle will pick up mass media attention and the 'orange man bad' crowd will activate to make sure this doesn't get far. There may even be debates on encryption and people may actually talk about encryption, privacy and policy.
  • ciarannolan 6y ago
    Wouldn't this work both ways? "The Deep State wants to read your Facebook messages!", etc.
• Jon_Lowtek 6y ago
  Back in late medieval europa most postal services had a back room, called cabinet noir where letters where carefully opened, read and resealed to check them for signs of treason against the crown or cross. These were often abused for what we today would call economic espionage. For these reasons many rich people employed private couriers who traveled to their business partners in person to hand over messages. Those who could not afford such luxury had to rely on codes. The prevalence of such codes however increased the chance of being misunderstood by those who searched for treason. When the emerging middle class started to demand political power in the renaissance it was answered with violence and repression. Those who wrote the constitutions of all modern western nations understood that democracy can only exist when the state has no business reading the correspondence of its citizens. Today many argue the state has a need to access such correspondence to prevent crime, but such a need is like the need of an addict: nothing good can come from it and the people should not enable these institutions to satisfy an ever growing demand for insight into their private lives. One must remember that democracy is founded on the believe that thoughts and words are not crimes and everyone must be free to express them-self in public, but even more so in private correspondence. A society that mistrusts its own citizens to a point where all those that whisper to each other are called criminals, dealers, traitors or terrorists is rotten at its core. And yet some still say: but if the state can read all private correspondence it would be so much easier to catch criminals. And yes, it is true that these totalitarian methods ar efficient in fighting street level crime. However for society as a whole, such methods enable a terror of the state that is a crime against humanity itself. They say "but the state will never abuse its power" and i say: it did countless times before. Do not stray away from liberty and freedom for promises of safety made by those that profit from oppression.
  • souljourner 6y ago
    How ironic that you say that in a forum that censors speech it does not want you to hear. Yup … just like this. Yes, you are the badies, mods/admins.
    • throwaway212312 6y ago
      This. It's telling that you are also being downvoted. The mods have a habit of censoring things and then uncensoring it when they think of a strawman to respond with, and of course, censoring the response to the strawman. Classic cointelpro.
• throwaway212312 6y ago
  There are feds in this thread right now. HN needs to list shill tactics in the newbie FAQ or this will become another reddit real soon.
• knobcore 6y ago
  If you're so scared about your government that your activity might get you thrown away for life and it doesn't involve murdering someone, then you need better government, not better security because those kinds of governments will just say you murdered someone without any proof and lock you up or kill you anyway if they don't like you.
  • loughnane 6y ago
    I know of no government ever that has been so benevolent that its citizens didn't benefit from privacy and security.
    • knobcore 6y ago
      This implies that said governments are bad. Or have the perception of it. You know who benefits from VPNs, privacy, and security? The proud boys. Russia. China. Steve Bannon. And their bots, that's who. They are a threat to civil society at present, and they're using that very privacy and security to organize to destroy the thing you're trying to "protect" by drinking Barlow's kool-aid.
      • knobcore 6y ago
        I prefer the idea of internet governance via third party instead of the state. Flip it on it's head, where instead of government spying on everyone, we're in control of the surveillance democratically through consensus. But there needs to be some kind of governance of some kind.
      • loughnane 6y ago
        Those people also benefit from cash, opaque walls, and freedom of speech. That bad people benefit from something is hardly a damning case against it.
  • BlueScreenDeath 6y ago
    Like they did to Ross Ulbricht? [1] https://freeross.org/real-untold-story/ https://freeross.org/real-untold-story/
• BlueScreenDeath 6y ago
  The FEDs are already here, "cleaning" up the comments. I just saw 1/2 a dozen comments get removed when I tired to reply. Honestly, fuck you HN. You guys suck.
• greenie_beans 6y ago
  Here is the contact form for the Senator who is Chairman of the Committee on Commerce, Science, and Transportation. I'm pretty sure that's the committee who would be involved with this bill. https://www.wicker.senate.gov/public/index.cfm/contact https://www.wicker.senate.gov/public/index.cfm/contact
  • Rebelgecko 6y ago
    It already passed through the Senate Judiciary Committee unanimously
    • greenie_beans 6y ago
      i didn't know that. what does that mean for the fate of this bill? doesn't that just mean that the senate must consider it? does the commerce committee have anything to do with it? since they oversee commerce and basically the internet (at least from what little i know...)
      • nobody9999 6y ago
        >i didn't know that. what does that mean for the fate of this bill? IIUC, for this particular bill[0], the next step in the Senate is to debate it on the floor and then vote on it. The companion House bill[1] has been introduced, but has not gone through committee or been voted upon. The Senate would need to pass the bill. Then, separately, the House would need to pass their bill. Then, the House and Senate would reconcile their two bills, and the resulting compromise bill would once again need be voted upon and passed by each chamber. Assuming that happens, the President would need to sign it before it becomes law. Most Americans (I hope) could tell you that. The links below detail the various actions taken by each chamber, as well as the sponsors and text of the bills. [0] https://www.congress.gov/bill/116th-congress/senate-bill/3398/all-actions?overview=closed#tabs https://www.congress.gov/bill/116th-congress/senate-bill/339... [1] https://www.congress.gov/bill/116th-congress/house-bill/8454 https://www.congress.gov/bill/116th-congress/house-bill/8454
        • 6y ago
• hospadar 6y ago
  Things the EARN-IT bill (reminder: supposedly designed to protect children) doesn't do: - Increase funding for child protective services & foster care services - Increase funding for parents (EBT, social work, etc) - Increase funding for schools (comprehensive sex ed, etc) Because our priority is kids! Honestly! Seriously I mean it!
  • koheripbal 6y ago
    Not to be pedantic, but those services are funded at the state level, so it would be odd if they allocated part of the Federal budget for it. Not that that would be bad, it's just that there are norms for who-does-what in gov't, and overlap of responsibilities is usually bad.
    • lisper 6y ago
      The federal government can provide funding for state programs without taking over the administration of those programs. That happens all the time.
  • bserge 6y ago
    "Protect the kids" has been a meme for some time now. It's a dead horse being beaten in the afterlife. Surprisingly, it still works.
  • Spivak 6y ago
    Are you mad that laws against murder (reminder: supposedly designed to protect people) don't include funding for domestic abuse shelters, food pantries, social workers, relocation programs, job retraining, college tuition assistance, and comprehensive sex ed? This kind of rhetoric is so boring at this point. Trying to destroy a proposal via scope creep is intellectually dishonest and does little more than weaken your own sides position. If I was a senator on the fence about this bill and this was the best argument you could muster against it it would be an easy yea.
    • nerdponx 6y ago
      Actually, yes. This is the entire problem with "tough on crime" policy: it doesn't attempt to handle the causes of criminality.
• 0df8dkdf 6y ago
  We ought to support the bill. However, NO digital communication is secure. Start put all important information in NON digital form.
• RIMR 6y ago
  I actually kind of hope it passes just because it will stimulate the development of decentralized encrypted communication services VERY fast. What good is this law if it only motivates people to make their communications even more secure?
• michae2 6y ago
  I have been wondering if there is a way to satisfy law enforcement without breaking encryption or adding backdoors. An idea: what if platforms allowed law enforcement (with a warrant) to conduct rainbow table attacks against encrypted content of a specific user? In other words, what if platforms allowed law enforcement to determine whether a specific known object (e.g. a known photo or video) was sent / stored by a user rather than decrypting all sent or stored objects? This would allow law enforcement to track the spread of a known piece of content while avoiding breaking encryption. Perhaps it could be a compromise.
  • ios14 6y ago
    Maybe this is possible instead with homomorphic encryption.
  • 7786655 6y ago
    There is no situation in which the spread of "content" should be a crime. Any encryption that allows LE to track content is broken.
    • michae2 6y ago
      Good points. Remembering back to the PRISM disclosures, metadata alone is enough to build a surveillance apparatus. So I guess even without decryption of all objects, confirmation of the existence of known objects could still be enough to conduct mass surveillance or enable other kinds of abuse.
  • upofadown 6y ago
    >to determine whether a specific known object (e.g. a known photo or video) was sent / stored by a user rather than decrypting all sent or stored objects? It is standard practice to make it so that it is impossible to detect identical plaintext. What you are describing would count as a backdoor. So you might as well instead make it explicit and save any sort of brute forcing (rainbow tables?).
  • nobody9999 6y ago
    >I have been wondering if there is a way to satisfy law enforcement without breaking encryption or adding backdoors I'd say "how about having law enforcement do, you know, police work to catch the bad guys?" Police can already get warrants for just about anything -- as long as they can convince a judge they have probable cause[0] -- without too much of a hassle already. Giving them keys to unlock everything is the wrong way to go about it. Get enough evidence to convince a judge (not that hard) and you can get a warrant. However, that doesn't mean anyone, even criminals, should be forced to make it easy for them. Law enforcement obviously has way too much time on their hands, with the amount of lobbying they do to increase their ability to chip away at civil liberties and privacy. Crazy thought: maybe they should use those resources to do real police work instead. [0] https://www.law.cornell.edu/wex/probable_cause https://www.law.cornell.edu/wex/probable_cause
• fmakunbound 6y ago
  Well I emailed 'em again. Don't think there's much hope when your reps are McCaul, Cornyn and fucking Ted Cruz. I hope this is Lindsey Graham's last piece of legislation though.
  • coolspot 6y ago
    As someone represented by Feinstein - there is no much more hope as well.
• Rafuino 6y ago
  I don't get the sudden press on this bill. It was introduced in March, and it was added to the Senate calendar in July. There was one hearing back in March, yes, but there isn't even a companion bill in the House at this point. Don't get me wrong, it's bad legislation, but is there some imminent action planned? https://www.congress.gov/bill/116th-congress/senate-bill/3398/all-actions-without-amendments?q=%7B%22search%22%3A%5B%22s.3398%22%5D%7D&s=1&r=1 https://www.congress.gov/bill/116th-congress/senate-bill/339...
  • snarf21 6y ago
    Keep trying until it passes. Use distractions from elsewhere to pass it like thieves in the night.
• ios14 6y ago
  Unpopular view, but unrecoverable encryption deployed at web scale is a cancer on society. While unrecoverable encryption provides additional privacy to law abiding citizens, it normalizes low level criminal activity at scale. There has to be a better trade-off here that minimizes the risks of 3rd party access, and gives law enforcement and the intelligence agencies the tools they need to do the best possible job. If I had to choose, I’d rather my consumer endpoints be hardened but have vetted and protected exceptional access mechanisms on the encryption. In practice, this bill is likely to lead to cut corners by big tech, who won’t be legally mandated to actually build increasingly responsible encryption recovery mechanisms for LEO. This will enable big tech to say, “I told you so”, because they were simply doing the minimum amount that was required of them legally.
  • vlovich123 6y ago
    Would a bill really eliminate the concept altogether? It might make their business more expensive in certain parts but there are multi-billion dollar criminal empires that invest in things like their own submarine tech. Do you think e2e encryption isn't something they'd develop in-house & resell to each other? At best it might help catch some street level crime but any serious organized crime (which arguably is a bigger problem because it's organized) will have the tools available anyway. Consider it this way. There's already a black market for security exploits with exploits frequently costing far more than they might actually otherwise be worth (there's a limited time utility before the exploit is patched). How much do you think e2e encryption would cost & do you think there's not going to be buyers & sellers for this? Especially since, unlike exploits, this is an infinitely distributable solution. I can sell to as many buyers as I want without risking my revenue stream. On the technical side we've observed what happens with this stuff. We'd be one Snowden-style leak away from all websites instantly becoming vulnerable. Do you not think that might be valuable to adversaries of the USA?
    • ios14 6y ago
      >criminal empires True, you can’t stop math but you can try to police it. You can regulate consumer access. Doing so means one less “gone dark” area, which makes LE job easier. >security exploits To your point about low level criminals: Now that the cat is out of the bag, yes, surveillance worked way better when people didn’t know about it. Yes, more sophisticated criminals will try to employ their own encryption. If I were in LE or the IC, I’d still rather not deal with the oceans of data produced by essentially unbreakable encryption via big tech. Will address point about uncapped value to an encryption exploit below. >Snowden-style leak Yes, which is why it is imperative to continually improve and audit such systems, including maybe removing such single points of failure as you noted, both from an insider threat perspective as well as from exploit discovery processes. It would be helpful to consider how to build recoverable encryption in a way that minimizes the risks of the existence of the exceptional access mechanism, from all angles: technical, social, etc
• Angeo34 6y ago
  I can only repeat myself. If you are US based privacy is a literal oxymoron for you. Not saying that's not the case anywhere else but it's especially bad for US and it's biggest allies (Saudi Arabia and Israel). Again go ahead give me all the down it's.
  • nobody9999 6y ago
    >but it's especially bad for US and it's biggest allies (Saudi Arabia and Israel). I'd say that the UK, Canada, Germany, France and the rest of NATO[0] are the US' biggest allies. Followed by countries like Japan, South Korea, Australia and even Mexico that are much more important as allies to the US than either of those places. Saudi Arabia and Israel are just incidental players for the US. Saudi Arabia for the oil (The Saudi state oil company is now called Saudi Aramco, but used to be called Arabian-American Oil Company[1]), the military bases, and the arms sales. Israel mostly for the arms sales and to placate many (but certainly not all) Jewish folk in the US. [0] https://en.wikipedia.org/wiki/NATO https://en.wikipedia.org/wiki/NATO [1] https://en.wikipedia.org/wiki/Saudi_Aramco https://en.wikipedia.org/wiki/Saudi_Aramco
• skee0083 6y ago
  The earn it bill is already unenforceable. open source crypto already exists and is available everywhere. so yea. good luck stopping people from using it.
  • aijrlaiwe 6y ago
    This means anyone implementing and using effective crypto will be flagged for closer monitoring. A jury is made up of twelve people who aren't smart enough to get out of jury duty. It won't be hard for a prosecutor to convince them that going out of your way to use encryption is proof of possessing child pornography. Or terrorist stuff. Or drug stuff. Or whatever else people are terrified of at the time.
    • manfredo 6y ago
      Then start sending random bytes of everyone. Random bytes are undistinguishable from encrypted data. If everyone is in possession of what appears to be encrypted data, then it's no longer reasonable cause for suspicion.
      • dane-pgp 6y ago
        Unless receiving/storing unexplainable random bytes becomes illegal (like "forgetting" your password).
        • manfredo 6y ago
          Right that's why you send random bytes to other people. You're forcing everyone else to receive or store random bytes. Thus rendering any actual enforcement of a law forbidding possession of encrypted data (or random bytes) nigh-impossible. If someone gets charged for possession of random bytes, send the prosecutor and judge a bunch of random bytes and see if they're still intent on moving forward with charges.
          • dane-pgp 6y ago
• mikorym 6y ago
  As a non-American, how would they be able to enforce something like this? Is it related to the HTTP specification? What stops me from encrypting things?
• hoppla 6y ago
  I guess zoom won’t have end to end encryption after all... if this gets implemented, I wonder how it will affect non-US services. Perhaps PaaS (Privacy-as-a-Service) will be a EU export product?
• mrobot 6y ago
  Does this apply to individuals or people hosting their own services or services for their friends? Also, can someone come to me with a subpoena and a gag order for hosting email for my friends?
• chosen1111 6y ago
  When you look at the things the left and right agree on you can see who really runs the show.
• DarkWiiPlayer 6y ago
  Let's be real, beyond this being bullshit, it's double-bullshit. Setting aside that it's a morally corrupt idea that wouldn't help, it wouldn't even work. You can't get rid of encription. Code is easier to spread than both drugs and guns and neither of them are as widely useful to criminals. How could anybody who's not completely incompetent think that this would possibly affect more than just the average consumer? Who votes for these clowns?